Lockean

Lockean is a financially motivated ransomware affiliate group active since at least 2020 and notably associated with intrusions against French companies. Rather than operating a single proprietary ransomware strain, Lockean functioned as a multi-RaaS affiliate and deployed payloads from several ransomware ecosystems, including DoppelPaymer, Maze, Egregor, ProLock, and REvil. The group used a double-extortion model, stealing victim data prior to encryption and monetizing intrusions through ransom payments while sharing proceeds with ransomware operators. Lockean commonly obtained initial access through malware distribution chains involving Qbot/QakBot, including access delivered via Emotet before its disruption and later via TA551. At least one intrusion was associated with IcedID-based access. Post-compromise activity included use of Cobalt Strike for hands-on intrusion operations, AdFind and BloodHound for reconnaissance and Active Directory mapping, BITSadmin for operational support, and Rclone for data exfiltration. Reported victimology includes organizations in transportation, media, manufacturing, and pharmaceuticals. Lockean is best understood as an affiliate cluster within the broader cybercriminal ransomware ecosystem rather than a standalone ransomware brand. Its operations demonstrate flexible alignment with multiple ransomware-as-a-service programs and collaboration with upstream access providers such as TA551. High-confidence reporting ties the group to repeated compromises of French enterprises over an extended period, with indications it may have operated beyond France as well, though broader geographic scope is less firmly established.